T-MARKET API

Connect to T-MARKET

Manage keys in T-MARKET → API in your Bitcofy account. A new key starts with read access. Enable trading separately to place or cancel orders. Keys expire after the selected period and can be revoked at any time.

API keys cannot withdraw funds or transfer balances between Main, Trading or Gaming. Only your Trading account is accessible. Fund it through the Bitcofy interface.

https://bitcofy.pro/api/t-market/v1

Use HTTPS. Send the key in the header, never in a query string or URL:

Authorization: Bearer $BITCOFY_API_KEY

The credential contains a UUIDv4 and a random 256-bit secret. It is shown once. Bitcofy stores a SHA-256 digest. If the credential is lost, revoke the key and create a replacement. Do not put keys in browser applications distributed to other users, public repositories, screenshots or logs.

Revocation blocks new requests. It does not cancel existing orders or undo a command already accepted for processing. Turn off trading access without revoking the key to keep read access.

Exact amounts and market rules

All prices, quantities, balances, fees, timestamps and large counters are returned as strings. Use an exact decimal or integer library; avoid binary floating point for amounts. The API accepts financial inputs as JSON strings, not JSON numbers. Extra request fields are rejected.

Call GET /markets for authoritative market IDs, network names, enabled status, price/quantity increments, minimum execution value, maximum price/quantity, per-order value limit and open-order limit. An asset’s network is part of its unique asset key; abbreviated tickers are not unique.

Fees are deducted from the asset received by each side at execution: buyers pay in the base asset, sellers in the quote asset. Rates: maker 0.001 = 0.1%, taker 0.002 = 0.2%. Read current rates from /markets. Existing orders retain the fee schedule accepted when created. Fills and fees settle atomically in the ledger.

USDT is real USDT from BSC Mainnet. USDT market minimums are disabled by default and can be configured per market by the administrator. A configured minimum applies to each fill; a smaller remainder is canceled and its reserve released. Read the current minimum and maximum quantity from the catalog. Trading may pause if a network cannot be verified; read access and order cancellation remain available where the engine permits them.

Order types and execution

Limit: type="limit", price in quote per one base asset, quantity in base units. Default time-in-force is GTC: the remaining quantity rests until filled or canceled. IOC executes immediately available quantity and cancels the remainder. FOK fills the entire quantity immediately or cancels it.

Post-only: set post_only=true for a GTC limit order. An order that would immediately cross the book is rejected rather than charged a taker fee.

Market: type="market" always uses IOC, is never post-only and never leaves a resting order. price is mandatory as a worst permitted execution price: maximum for a buy, minimum for a sell. This protects against uncontrolled slippage in a thin book. quantity is the maximum base quantity.

Market buys additionally require max_spend: a quote-asset budget for the spend principal. It is not supported for limit orders or sells. Exhausted budget, missing liquidity, minimum execution and self-trade prevention may produce a partial fill or cancellation. HTTP success means the engine has returned a result; inspect status, reason and filled/remaining quantities.

The engine reserves required balances, applies deterministic ordering, prevents self-trading and posts trades, fees and reserve release atomically. API orders use the same wallet, limits and execution rules as interface orders.

Idempotency and recovery

Every place/cancel command requires Idempotency-Key containing a UUIDv4. Generate a new ID only for a genuinely new action. Persist the ID and exact request payload before sending.

Retry the same command with the same ID and payload after a network error or unknown confirmation. Duplicate execution is prevented by the shared command sequencer and database. Reusing the ID for a different request yields HTTP 409. IDs belong to the user account across API keys and interface commands.

Use GET /commands/{operation_id} to retrieve a committed result. HTTP 404 means no result is visible yet; it does not prove that a previous request cannot still complete. Continue retrying the original request with the original ID. Never replace its ID merely because an HTTP timeout occurred.

Cancellation has its own command UUID. The original placement UUID is the order ID. Repeating a cancel command is safe; cancellation cannot undo fills that have already committed.

import os, uuid, requests
base = "https://bitcofy.pro/api/t-market/v1"
headers = {"Authorization": "Bearer " + os.environ["BITCOFY_API_KEY"],
           "Idempotency-Key": str(uuid.uuid4())}
order = {"market": "BTC_TESTNET4__USDT_BSC", "side": "buy",
         "type": "limit", "tif": "GTC", "post_only": False,
         "price": "2.50", "quantity": "0.01"}
# Persist headers["Idempotency-Key"] and order before submitting.
r = requests.post(base + "/orders", headers=headers, json=order, timeout=25)
print(r.status_code, r.json())
# On an unknown outcome, retry with exactly the same headers and order.

This example can spend real USDT. Read the market rules and available balance before using it.

Limits and errors

Rate limits use token buckets shared across API processes. Public traffic: 30 requests/s per IP, burst 60. Authenticated reads additionally allow 10 requests/s per key and user, burst 30. Trading additionally allows 5 requests/s per key and user, burst 10. The IP bucket also applies to private and invalid-authentication requests. Creating extra keys does not bypass the user limit. Reverse-proxy/network protections may impose lower limits.

HTTP 429 includes Retry-After in seconds. Back off instead of immediately retrying in a loop. If the limiter is unavailable, the public API fails closed with 503. Read concurrency and the engine’s command queue are bounded. JSON command bodies are limited to 16 KiB. Requests and responses must not be cached.

Errors use {"detail": "message"} or {"detail": {"code": "machine_code", "message": "message"}}. Validation errors use FastAPI’s structured detail array. Never infer a new order ID from an error.

Endpoints

Expand an endpoint for parameters and behavior. Download the OpenAPI 3.1 specification for generated clients. API v1 is REST; this version does not expose an authenticated public WebSocket stream.

{"market":"BTC_TESTNET4__USDT_BSC", "side":"buy",
 "type":"limit", "price":"2.50", "quantity":"0.01",
 "tif":"GTC", "post_only":false}

{"operation_id":"UUIDv4", "order_id":"UUIDv4", "sequence":"123",
 "status":"open", "reason":"", "filled_lots":"0", "remaining_lots":"1000000"}